PT-2026-5265 · Unknown+1 · Defaultpluginoperator+1

Mukyuuhate · Published 2026-01-29 · Updated 2026-01-29 · CVE-2026-1588

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions jishenghua jshERP versions prior to 3.6

Description A path traversal issue exists in the install function of the /jshERP-boot/plugin/installByPath file within the com.gitee.starblues.integration.operator.DefaultPluginOperator component. Manipulation of the path argument can lead to path traversal. This issue is potentially exploitable remotely. The exploit has been publicly released. The project maintainers were notified but have not yet responded.

Recommendations Versions prior to 3.6: Update to a newer version to address the vulnerability. As a temporary workaround, restrict access to the /jshERP-boot/plugin/installByPath endpoint. Avoid using untrusted input for the path parameter.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-1588

Affected Products

Defaultpluginoperator

Jsherp

References · 9

• 🔥 https://github.com/jishenghua/jshERP/issues/147 · Exploit
• https://osv.dev/vulnerability/CVE-2026-1588 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1588 · Security Note
• https://twitter.com/VulmonFeeds/status/2016883609248891246 · Twitter Post
• https://vuldb.com/?ctiid.343351 · Note
• https://github.com/jishenghua/jshERP · Note
• https://twitter.com/CVEnew/status/2016881160450953682 · Twitter Post
• https://vuldb.com/?id.343351 · Note
• https://vuldb.com/?submit.740649 · Note